Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 2 additions & 5 deletions central/cve/converter/utils/convert_utils_v2.go
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ func ImageCVEV2ToEmbeddedVulnerability(vuln *storage.ImageCVEV2) *storage.Embedd
}

// EmbeddedVulnerabilityToImageCVEV2 converts *storage.EmbeddedVulnerability object to *storage.ImageCVEV2 object
func EmbeddedVulnerabilityToImageCVEV2(imageID string, componentID string, from *storage.EmbeddedVulnerability) (*storage.ImageCVEV2, error) {
func EmbeddedVulnerabilityToImageCVEV2(imageID string, componentID string, index int, from *storage.EmbeddedVulnerability) (*storage.ImageCVEV2, error) {
var nvdCvss float32
nvdVersion := storage.CvssScoreVersion_UNKNOWN_VERSION
for _, score := range from.GetCvssMetrics() {
Expand All @@ -76,10 +76,7 @@ func EmbeddedVulnerabilityToImageCVEV2(imageID string, componentID string, from
impactScore = from.GetCvssV2().GetImpactScore()
}

cveID, err := cve.IDV2(from, componentID)
if err != nil {
return nil, err
}
cveID := cve.IDV2(from, componentID, index)

ret := &storage.ImageCVEV2{
Id: cveID,
Expand Down
27 changes: 11 additions & 16 deletions central/cve/converter/utils/convert_utils_v2_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@ import (
"github.com/stackrox/rox/pkg/protocompat"
"github.com/stackrox/rox/pkg/scancomponent"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)

type componentPieces struct {
Expand Down Expand Up @@ -144,28 +143,24 @@ func TestImageCVEV2ToEmbeddedCVEs(t *testing.T) {
func TestEmbeddedCVEToImageCVEV2(t *testing.T) {
for idx, embeddedVuln := range testVulns {
componentInfo := getComponentInfo(t)
convertedVuln, err := EmbeddedVulnerabilityToImageCVEV2(componentInfo[idx].imageID, componentInfo[idx].componentID, embeddedVuln)
convertedVuln, err := EmbeddedVulnerabilityToImageCVEV2(componentInfo[idx].imageID, componentInfo[idx].componentID, idx, embeddedVuln)
assert.NoError(t, err)
protoassert.Equal(t, getTestCVEs(t)[idx], convertedVuln)
}
}

func getTestComponentID(t *testing.T) string {
id, err := scancomponent.ComponentIDV2(testComponent, "sha")
require.NoError(t, err)
return id
func getTestComponentID(index int) string {
return scancomponent.ComponentIDV2(testComponent, "sha", index)
}

func getTestCVEID(t *testing.T, testCVE *storage.EmbeddedVulnerability, componentID string) string {
id, err := cve.IDV2(testCVE, componentID)
require.NoError(t, err)
return id
func getTestCVEID(testCVE *storage.EmbeddedVulnerability, componentID string, index int) string {
return cve.IDV2(testCVE, componentID, index)
}

func getTestCVEs(t *testing.T) []*storage.ImageCVEV2 {
return []*storage.ImageCVEV2{
{
Id: getTestCVEID(t, testVulns[0], getTestComponentID(t)),
Id: getTestCVEID(testVulns[0], getTestComponentID(0), 0),
ImageId: "sha",
CveBaseInfo: &storage.CVEInfo{
Cve: "cve1",
Expand Down Expand Up @@ -229,10 +224,10 @@ func getTestCVEs(t *testing.T) []*storage.ImageCVEV2 {
State: 0,
IsFixable: false,
HasFixedBy: nil,
ComponentId: getTestComponentID(t),
ComponentId: getTestComponentID(0),
},
{
Id: getTestCVEID(t, testVulns[1], getTestComponentID(t)),
Id: getTestCVEID(testVulns[1], getTestComponentID(1), 1),
ImageId: "sha",
CveBaseInfo: &storage.CVEInfo{
Cve: "cve2",
Expand Down Expand Up @@ -271,7 +266,7 @@ func getTestCVEs(t *testing.T) []*storage.ImageCVEV2 {
HasFixedBy: &storage.ImageCVEV2_FixedBy{
FixedBy: "ver3",
},
ComponentId: getTestComponentID(t),
ComponentId: getTestComponentID(1),
},
}
}
Expand All @@ -280,12 +275,12 @@ func getComponentInfo(t *testing.T) []*componentPieces {
return []*componentPieces{
{
imageID: "sha",
componentID: getTestComponentID(t),
componentID: getTestComponentID(0),
cveIndex: 0,
},
{
imageID: "sha",
componentID: getTestComponentID(t),
componentID: getTestComponentID(1),
cveIndex: 1,
},
}
Expand Down
364 changes: 182 additions & 182 deletions central/cve/image/v2/datastore/datastore_sac_test.go

Large diffs are not rendered by default.

15 changes: 6 additions & 9 deletions central/deployment/datastore/datastore_impl_postgres_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -83,19 +83,16 @@ func (s *DeploymentPostgresDataStoreTestSuite) TestSearchWithPostgres() {
s.NoError(s.deploymentDatastore.UpsertDeployment(ctx, dep2))
s.NoError(s.deploymentDatastore.UpsertDeployment(ctx, dep3))

componentIDImg2, err := scancomponent.ComponentIDV2(
componentIDImg2 := scancomponent.ComponentIDV2(
img2.GetScan().GetComponents()[0],
img2.GetId())
s.NoError(err)
img2.GetId(), 0)

componentIDImg1, err := scancomponent.ComponentIDV2(
componentIDImg1 := scancomponent.ComponentIDV2(
img1.GetScan().GetComponents()[0],
img1.GetId())
s.NoError(err)
cveID, err := cve.IDV2(
img1.GetId(), 0)
cveID := cve.IDV2(
img1.GetScan().GetComponents()[0].GetVulns()[0],
componentIDImg1)
s.NoError(err)
componentIDImg1, 0)

for _, tc := range []struct {
desc string
Expand Down
52 changes: 26 additions & 26 deletions central/graphql/resolvers/image_components_v2_postgres_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -364,12 +364,12 @@ func (s *GraphQLImageComponentV2TestSuite) TestImageComponentImageVulnerabilitie
"comp1os1",
s.componentIDMap[comp11],
[]string{
getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2018-1",
getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2018-1",
SetFixedBy: &storage.EmbeddedVulnerability_FixedBy{
FixedBy: "1.1",
},
Severity: storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp11]),
}, s.componentIDMap[comp11], 0),
},
&VulnerabilityCounterResolver{
all: &VulnerabilityFixableCounterResolver{0, 1},
Expand All @@ -383,12 +383,12 @@ func (s *GraphQLImageComponentV2TestSuite) TestImageComponentImageVulnerabilitie
"comp2os1",
s.componentIDMap[comp21],
[]string{
getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2018-1",
getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2018-1",
SetFixedBy: &storage.EmbeddedVulnerability_FixedBy{
FixedBy: "1.5",
},
Severity: storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp21]),
}, s.componentIDMap[comp21], 0),
},
&VulnerabilityCounterResolver{
all: &VulnerabilityFixableCounterResolver{0, 1},
Expand All @@ -402,14 +402,14 @@ func (s *GraphQLImageComponentV2TestSuite) TestImageComponentImageVulnerabilitie
"comp3os1",
s.componentIDMap[comp31],
[]string{
getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2019-1",
getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2019-1",
Cvss: 4,
Severity: storage.VulnerabilitySeverity_MODERATE_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp31]),
getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2019-2",
}, s.componentIDMap[comp31], 0),
getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2019-2",
Cvss: 3,
Severity: storage.VulnerabilitySeverity_LOW_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp31]),
}, s.componentIDMap[comp31], 1),
},
&VulnerabilityCounterResolver{
all: &VulnerabilityFixableCounterResolver{0, 0},
Expand All @@ -423,12 +423,12 @@ func (s *GraphQLImageComponentV2TestSuite) TestImageComponentImageVulnerabilitie
"comp1os2",
s.componentIDMap[comp12],
[]string{
getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2018-1",
getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2018-1",
SetFixedBy: &storage.EmbeddedVulnerability_FixedBy{
FixedBy: "1.1",
},
Severity: storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp12]),
}, s.componentIDMap[comp12], 0),
},
&VulnerabilityCounterResolver{
all: &VulnerabilityFixableCounterResolver{0, 1},
Expand All @@ -442,14 +442,14 @@ func (s *GraphQLImageComponentV2TestSuite) TestImageComponentImageVulnerabilitie
"comp3os2",
s.componentIDMap[comp32],
[]string{
getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2019-1",
getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2019-1",
Cvss: 4,
Severity: storage.VulnerabilitySeverity_MODERATE_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp32]),
getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2019-2",
}, s.componentIDMap[comp32], 0),
getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2019-2",
Cvss: 3,
Severity: storage.VulnerabilitySeverity_LOW_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp32]),
}, s.componentIDMap[comp32], 1),
},
&VulnerabilityCounterResolver{
all: &VulnerabilityFixableCounterResolver{0, 0},
Expand All @@ -463,14 +463,14 @@ func (s *GraphQLImageComponentV2TestSuite) TestImageComponentImageVulnerabilitie
"comp4os2",
s.componentIDMap[comp42],
[]string{
getTestCVEID(s.T(), &storage.EmbeddedVulnerability{
getTestCVEID(&storage.EmbeddedVulnerability{
Cve: "cve-2017-1",
Severity: storage.VulnerabilitySeverity_IMPORTANT_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp42]),
getTestCVEID(s.T(), &storage.EmbeddedVulnerability{
}, s.componentIDMap[comp42], 0),
getTestCVEID(&storage.EmbeddedVulnerability{
Cve: "cve-2017-2",
Severity: storage.VulnerabilitySeverity_IMPORTANT_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp42]),
}, s.componentIDMap[comp42], 1),
},
&VulnerabilityCounterResolver{
all: &VulnerabilityFixableCounterResolver{0, 0},
Expand Down Expand Up @@ -566,10 +566,10 @@ func (s *GraphQLImageComponentV2TestSuite) TestTopImageVulnerability() {

comp := s.getImageComponentResolver(ctx, s.componentIDMap[comp31])

expectedID := graphql.ID(getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2019-1",
expectedID := graphql.ID(getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2019-1",
Cvss: 4,
Severity: storage.VulnerabilitySeverity_MODERATE_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp31]))
}, s.componentIDMap[comp31], 0))

vuln, err := comp.TopImageVulnerability(ctx)
assert.NoError(s.T(), err)
Expand All @@ -595,11 +595,11 @@ func (s *GraphQLImageComponentV2TestSuite) getImageComponentResolver(ctx context

func (s *GraphQLImageComponentV2TestSuite) getComponentIDMap() map[string]string {
return map[string]string{
comp11: getTestComponentID(s.T(), testImages()[0].GetScan().GetComponents()[0], "sha1"),
comp12: getTestComponentID(s.T(), testImages()[1].GetScan().GetComponents()[0], "sha2"),
comp21: getTestComponentID(s.T(), testImages()[0].GetScan().GetComponents()[1], "sha1"),
comp31: getTestComponentID(s.T(), testImages()[0].GetScan().GetComponents()[2], "sha1"),
comp32: getTestComponentID(s.T(), testImages()[1].GetScan().GetComponents()[1], "sha2"),
comp42: getTestComponentID(s.T(), testImages()[1].GetScan().GetComponents()[2], "sha2"),
comp11: getTestComponentID(testImages()[0].GetScan().GetComponents()[0], "sha1", 0),
comp12: getTestComponentID(testImages()[1].GetScan().GetComponents()[0], "sha2", 0),
comp21: getTestComponentID(testImages()[0].GetScan().GetComponents()[1], "sha1", 1),
comp31: getTestComponentID(testImages()[0].GetScan().GetComponents()[2], "sha1", 2),
comp32: getTestComponentID(testImages()[1].GetScan().GetComponents()[1], "sha2", 1),
comp42: getTestComponentID(testImages()[1].GetScan().GetComponents()[2], "sha2", 2),
}
}
48 changes: 24 additions & 24 deletions central/graphql/resolvers/image_vulnerabilities_v2_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -718,56 +718,56 @@ func getCVEList(ctx context.Context, vulns []ImageVulnerabilityResolver) []strin

func (s *GraphQLImageVulnerabilityV2TestSuite) getIDMap() map[string]string {
return map[string]string{
cve111: getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2018-1",
cve111: getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2018-1",
SetFixedBy: &storage.EmbeddedVulnerability_FixedBy{
FixedBy: "1.1",
},
Severity: storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp11]),
cve121: getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2018-1",
}, s.componentIDMap[comp11], 0),
cve121: getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2018-1",
SetFixedBy: &storage.EmbeddedVulnerability_FixedBy{
FixedBy: "1.5",
},
Severity: storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp21]),
cve231: getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2019-1",
}, s.componentIDMap[comp21], 0),
cve231: getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2019-1",
Cvss: 4,
Severity: storage.VulnerabilitySeverity_MODERATE_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp31]),
cve331: getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2019-2",
}, s.componentIDMap[comp31], 0),
cve331: getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2019-2",
Cvss: 3,
Severity: storage.VulnerabilitySeverity_LOW_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp31]),
cve112: getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2018-1",
}, s.componentIDMap[comp31], 1),
cve112: getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2018-1",
SetFixedBy: &storage.EmbeddedVulnerability_FixedBy{
FixedBy: "1.1",
},
Severity: storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp12]),
cve232: getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2019-1",
}, s.componentIDMap[comp12], 0),
cve232: getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2019-1",
Severity: storage.VulnerabilitySeverity_MODERATE_VULNERABILITY_SEVERITY,
Cvss: 4,
}, s.componentIDMap[comp32]),
cve332: getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2019-2",
}, s.componentIDMap[comp32], 0),
cve332: getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2019-2",
Severity: storage.VulnerabilitySeverity_LOW_VULNERABILITY_SEVERITY,
Cvss: 3,
}, s.componentIDMap[comp32]),
cve442: getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2017-1",
}, s.componentIDMap[comp32], 1),
cve442: getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2017-1",
Severity: storage.VulnerabilitySeverity_IMPORTANT_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp42]),
cve542: getTestCVEID(s.T(), &storage.EmbeddedVulnerability{Cve: "cve-2017-2",
}, s.componentIDMap[comp42], 0),
cve542: getTestCVEID(&storage.EmbeddedVulnerability{Cve: "cve-2017-2",
Severity: storage.VulnerabilitySeverity_IMPORTANT_VULNERABILITY_SEVERITY,
}, s.componentIDMap[comp42]),
}, s.componentIDMap[comp42], 1),
}
}

func (s *GraphQLImageVulnerabilityV2TestSuite) getComponentIDMap() map[string]string {
return map[string]string{
comp11: getTestComponentID(s.T(), testImages()[0].GetScan().GetComponents()[0], "sha1"),
comp12: getTestComponentID(s.T(), testImages()[1].GetScan().GetComponents()[0], "sha2"),
comp21: getTestComponentID(s.T(), testImages()[0].GetScan().GetComponents()[1], "sha1"),
comp31: getTestComponentID(s.T(), testImages()[0].GetScan().GetComponents()[2], "sha1"),
comp32: getTestComponentID(s.T(), testImages()[1].GetScan().GetComponents()[1], "sha2"),
comp42: getTestComponentID(s.T(), testImages()[1].GetScan().GetComponents()[2], "sha2"),
comp11: getTestComponentID(testImages()[0].GetScan().GetComponents()[0], "sha1", 0),
comp12: getTestComponentID(testImages()[1].GetScan().GetComponents()[0], "sha2", 0),
comp21: getTestComponentID(testImages()[0].GetScan().GetComponents()[1], "sha1", 1),
comp31: getTestComponentID(testImages()[0].GetScan().GetComponents()[2], "sha1", 2),
comp32: getTestComponentID(testImages()[1].GetScan().GetComponents()[1], "sha2", 1),
comp42: getTestComponentID(testImages()[1].GetScan().GetComponents()[2], "sha2", 2),
}
}
14 changes: 4 additions & 10 deletions central/graphql/resolvers/test_utils.go
Original file line number Diff line number Diff line change
Expand Up @@ -753,16 +753,10 @@ func contextWithClusterPerm(t testing.TB, ctrl *gomock.Controller) context.Conte
return authn.ContextWithIdentity(sac.WithAllAccess(loaders.WithLoaderContext(context.Background())), id, t)
}

func getTestComponentID(t *testing.T, testComponent *storage.EmbeddedImageScanComponent, imageID string) string {
id, err := scancomponent.ComponentIDV2(testComponent, imageID)
require.NoError(t, err)

return id
func getTestComponentID(testComponent *storage.EmbeddedImageScanComponent, imageID string, index int) string {
return scancomponent.ComponentIDV2(testComponent, imageID, index)
}

func getTestCVEID(t *testing.T, testCVE *storage.EmbeddedVulnerability, componentID string) string {
id, err := cve.IDV2(testCVE, componentID)
require.NoError(t, err)

return id
func getTestCVEID(testCVE *storage.EmbeddedVulnerability, componentID string, index int) string {
return cve.IDV2(testCVE, componentID, index)
}
16 changes: 4 additions & 12 deletions central/image/datastore/datastore_impl.go
Original file line number Diff line number Diff line change
Expand Up @@ -363,13 +363,9 @@ func (ds *datastoreImpl) updateListImagePriority(images ...*storage.ListImage) {
func (ds *datastoreImpl) updateImagePriority(images ...*storage.Image) {
for _, image := range images {
image.Priority = ds.imageRanker.GetRankForID(image.GetId())
for _, component := range image.GetScan().GetComponents() {
for index, component := range image.GetScan().GetComponents() {
if features.FlattenCVEData.Enabled() {
componentID, err := scancomponent.ComponentIDV2(component, image.GetId())
if err != nil {
log.Error(err)
continue
}
componentID := scancomponent.ComponentIDV2(component, image.GetId(), index)
component.Priority = ds.imageComponentRanker.GetRankForID(componentID)
} else {
component.Priority = ds.imageComponentRanker.GetRankForID(scancomponent.ComponentID(component.GetName(), component.GetVersion(), image.GetScan().GetOperatingSystem()))
Expand All @@ -379,13 +375,9 @@ func (ds *datastoreImpl) updateImagePriority(images ...*storage.Image) {
}

func (ds *datastoreImpl) updateComponentRisk(image *storage.Image) {
for _, component := range image.GetScan().GetComponents() {
for index, component := range image.GetScan().GetComponents() {
if features.FlattenCVEData.Enabled() {
componentID, err := scancomponent.ComponentIDV2(component, image.GetId())
if err != nil {
log.Error(err)
continue
}
componentID := scancomponent.ComponentIDV2(component, image.GetId(), index)
component.RiskScore = ds.imageComponentRanker.GetScoreForID(componentID)
} else {
component.RiskScore = ds.imageComponentRanker.GetScoreForID(scancomponent.ComponentID(component.GetName(), component.GetVersion(), image.GetScan().GetOperatingSystem()))
Expand Down
Loading
Loading